From f8b0c92dab088a88372c47c0ccbb6c7ef0a4357b Mon Sep 17 00:00:00 2001 From: Aditya Jain Date: Fri, 14 Aug 2026 00:07:30 -0700 Subject: [PATCH] fix: HttpApi explicit AuthorizationScopes: [] is not overridden by authorizer default OpenApiEditor.add_auth_to_method defaulted an unset AuthorizationScopes to [], then _set_method_authorizer checked it with `if authorization_scopes:`. Since [] is falsy, this couldn't distinguish "not set" from an explicit empty-list override, so a method-level `AuthorizationScopes: []` (meant to require no scopes, overriding the authorizer's default) was silently ignored and the authorizer's default AuthorizationScopes were enforced instead. SwaggerEditor's equivalent REST API code path (swagger.py) already gets this right by using None as the "not set" sentinel and an `is not None` check. This applies the same fix to OpenApiEditor so HTTP APIs behave consistently with REST APIs, and also aligns the authorizer-presence check (`authorizers.get(authorizer_name) is not None`) with swagger.py's pattern. Fixes #3979 --- samtranslator/open_api/open_api.py | 9 +- ...ttp_api_with_auth_with_default_scopes.yaml | 87 +++++ ...ttp_api_with_auth_with_default_scopes.json | 368 ++++++++++++++++++ ...ttp_api_with_auth_with_default_scopes.json | 368 ++++++++++++++++++ ...ttp_api_with_auth_with_default_scopes.json | 368 ++++++++++++++++++ 5 files changed, 1194 insertions(+), 6 deletions(-) create mode 100644 tests/translator/input/http_api_with_auth_with_default_scopes.yaml create mode 100644 tests/translator/output/aws-cn/http_api_with_auth_with_default_scopes.json create mode 100644 tests/translator/output/aws-us-gov/http_api_with_auth_with_default_scopes.json create mode 100644 tests/translator/output/http_api_with_auth_with_default_scopes.json diff --git a/samtranslator/open_api/open_api.py b/samtranslator/open_api/open_api.py index 5fd785c02..0888e8fba 100644 --- a/samtranslator/open_api/open_api.py +++ b/samtranslator/open_api/open_api.py @@ -313,7 +313,7 @@ def add_auth_to_method(self, path, method_name, auth, api): # type: ignore[no-u :param dict api: Reference to the related Api's properties as defined in the template. """ method_authorizer = auth and auth.get("Authorizer") - authorization_scopes = auth.get("AuthorizationScopes", []) + authorization_scopes = auth.get("AuthorizationScopes") api_auth = api and api.get("Auth") authorizers = api_auth and api_auth.get("Authorizers") if method_authorizer: @@ -330,9 +330,6 @@ def _set_method_authorizer(self, path, method_name, authorizer_name, authorizers authorizers param. :param list authorization_scopes: list of strings that are the auth scopes for this method """ - if authorization_scopes is None: - authorization_scopes = [] - for method_definition in self.iter_on_method_definitions_for_path_at_method(path, method_name): security_dict = {} # type: ignore[var-annotated] security_dict[authorizer_name] = [] @@ -345,9 +342,9 @@ def _set_method_authorizer(self, path, method_name, authorizer_name, authorizers [InvalidTemplateException(f"Type of authorizer '{authorizer_name}' must be a dictionary")] ) method_authorization_scopes = authorizer.get("AuthorizationScopes") - if authorization_scopes: + if authorization_scopes is not None: method_authorization_scopes = authorization_scopes - if authorizers[authorizer_name] and method_authorization_scopes: + if authorizers.get(authorizer_name) is not None and method_authorization_scopes is not None: security_dict[authorizer_name] = method_authorization_scopes authorizer_security = [security_dict] diff --git a/tests/translator/input/http_api_with_auth_with_default_scopes.yaml b/tests/translator/input/http_api_with_auth_with_default_scopes.yaml new file mode 100644 index 000000000..431e333dc --- /dev/null +++ b/tests/translator/input/http_api_with_auth_with_default_scopes.yaml @@ -0,0 +1,87 @@ +Resources: + MyApiWithCognitoAuth: + Type: AWS::Serverless::HttpApi + Properties: + Auth: + DefaultAuthorizer: MyDefaultCognitoAuth + Authorizers: + MyDefaultCognitoAuth: + JwtConfiguration: + Audience: + - audience1 + Issuer: https://www.example.com/v1/connect/oidc/default + IdentitySource: $request.header.Authorization + AuthorizationScopes: + - default.write + - default.read + MyCognitoAuthWithDefaultScopes: + JwtConfiguration: + Audience: + - audience2 + Issuer: https://www.example.com/v1/connect/oidc/other + IdentitySource: $request.header.Authorization + AuthorizationScopes: + - default.delete + - default.update + + MyFn: + Type: AWS::Serverless::Function + Properties: + CodeUri: s3://bucket/key + Handler: index.handler + Runtime: nodejs12.x + Events: + CognitoAuthorizerWithDefaultScopes: + Type: HttpApi + Properties: + ApiId: !Ref MyApiWithCognitoAuth + Method: get + Path: /cognitoauthorizerwithdefaultscopes + Auth: + Authorizer: MyCognitoAuthWithDefaultScopes + CognitoDefaultScopesDefaultAuthorizer: + Type: HttpApi + Properties: + ApiId: !Ref MyApiWithCognitoAuth + Method: get + Path: /cognitodefaultscopesdefaultauthorizer + CognitoDefaultScopesWithOverwritten: + Type: HttpApi + Properties: + ApiId: !Ref MyApiWithCognitoAuth + Method: get + Path: /cognitodefaultscopesoverwritten + Auth: + Authorizer: MyDefaultCognitoAuth + AuthorizationScopes: + - overwritten.read + - overwritten.write + CognitoAuthorizerScopesOverwritten: + Type: HttpApi + Properties: + ApiId: !Ref MyApiWithCognitoAuth + Method: get + Path: /cognitoauthorizercopesoverwritten + Auth: + Authorizer: MyCognitoAuthWithDefaultScopes + AuthorizationScopes: + - overwritten.read + - overwritten.write + CognitoDefaultScopesNone: + Type: HttpApi + Properties: + ApiId: !Ref MyApiWithCognitoAuth + Method: get + Path: /cognitodefaultscopesnone + Auth: + Authorizer: MyDefaultCognitoAuth + AuthorizationScopes: [] + CognitoDefaultAuthDefaultScopesNone: + Type: HttpApi + Properties: + ApiId: !Ref MyApiWithCognitoAuth + Method: get + Path: /cognitodefaultauthdefaultscopesnone + Auth: + Authorizer: MyCognitoAuthWithDefaultScopes + AuthorizationScopes: [] diff --git a/tests/translator/output/aws-cn/http_api_with_auth_with_default_scopes.json b/tests/translator/output/aws-cn/http_api_with_auth_with_default_scopes.json new file mode 100644 index 000000000..9373c9870 --- /dev/null +++ b/tests/translator/output/aws-cn/http_api_with_auth_with_default_scopes.json @@ -0,0 +1,368 @@ +{ + "Resources": { + "MyApiWithCognitoAuth": { + "Properties": { + "Body": { + "components": { + "securitySchemes": { + "MyCognitoAuthWithDefaultScopes": { + "type": "oauth2", + "x-amazon-apigateway-authorizer": { + "identitySource": "$request.header.Authorization", + "jwtConfiguration": { + "audience": [ + "audience2" + ], + "issuer": "https://www.example.com/v1/connect/oidc/other" + }, + "type": "jwt" + } + }, + "MyDefaultCognitoAuth": { + "type": "oauth2", + "x-amazon-apigateway-authorizer": { + "identitySource": "$request.header.Authorization", + "jwtConfiguration": { + "audience": [ + "audience1" + ], + "issuer": "https://www.example.com/v1/connect/oidc/default" + }, + "type": "jwt" + } + } + } + }, + "info": { + "title": { + "Ref": "AWS::StackName" + }, + "version": "1.0" + }, + "openapi": "3.0.1", + "paths": { + "/cognitoauthorizercopesoverwritten": { + "get": { + "responses": {}, + "security": [ + { + "MyCognitoAuthWithDefaultScopes": [ + "overwritten.read", + "overwritten.write" + ] + } + ], + "x-amazon-apigateway-integration": { + "httpMethod": "POST", + "payloadFormatVersion": "2.0", + "type": "aws_proxy", + "uri": { + "Fn::Sub": "arn:${AWS::Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${MyFn.Arn}/invocations" + } + } + } + }, + "/cognitoauthorizerwithdefaultscopes": { + "get": { + "responses": {}, + "security": [ + { + "MyCognitoAuthWithDefaultScopes": [ + "default.delete", + "default.update" + ] + } + ], + "x-amazon-apigateway-integration": { + "httpMethod": "POST", + "payloadFormatVersion": "2.0", + "type": "aws_proxy", + "uri": { + "Fn::Sub": "arn:${AWS::Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${MyFn.Arn}/invocations" + } + } + } + }, + "/cognitodefaultauthdefaultscopesnone": { + "get": { + "responses": {}, + "security": [ + { + "MyCognitoAuthWithDefaultScopes": [] + } + ], + "x-amazon-apigateway-integration": { + "httpMethod": "POST", + "payloadFormatVersion": "2.0", + "type": "aws_proxy", + "uri": { + "Fn::Sub": "arn:${AWS::Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${MyFn.Arn}/invocations" + } + } + } + }, + "/cognitodefaultscopesdefaultauthorizer": { + "get": { + "responses": {}, + "security": [ + { + "MyDefaultCognitoAuth": [ + "default.write", + "default.read" + ] + } + ], + "x-amazon-apigateway-integration": { + "httpMethod": "POST", + "payloadFormatVersion": "2.0", + "type": "aws_proxy", + "uri": { + "Fn::Sub": "arn:${AWS::Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${MyFn.Arn}/invocations" + } + } + } + }, + "/cognitodefaultscopesnone": { + "get": { + "responses": {}, + "security": [ + { + "MyDefaultCognitoAuth": [] + } + ], + "x-amazon-apigateway-integration": { + "httpMethod": "POST", + "payloadFormatVersion": "2.0", + "type": "aws_proxy", + "uri": { + "Fn::Sub": "arn:${AWS::Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${MyFn.Arn}/invocations" + } + } + } + }, + "/cognitodefaultscopesoverwritten": { + "get": { + "responses": {}, + "security": [ + { + "MyDefaultCognitoAuth": [ + "overwritten.read", + "overwritten.write" + ] + } + ], + "x-amazon-apigateway-integration": { + "httpMethod": "POST", + "payloadFormatVersion": "2.0", + "type": "aws_proxy", + "uri": { + "Fn::Sub": "arn:${AWS::Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${MyFn.Arn}/invocations" + } + } + } + } + }, + "tags": [ + { + "name": "httpapi:createdBy", + "x-amazon-apigateway-tag-value": "SAM" + } + ] + } + }, + "Type": "AWS::ApiGatewayV2::Api" + }, + "MyApiWithCognitoAuthApiGatewayDefaultStage": { + "Properties": { + "ApiId": { + "Ref": "MyApiWithCognitoAuth" + }, + "AutoDeploy": true, + "StageName": "$default", + "Tags": { + "httpapi:createdBy": "SAM" + } + }, + "Type": "AWS::ApiGatewayV2::Stage" + }, + "MyFn": { + "Properties": { + "Code": { + "S3Bucket": "bucket", + "S3Key": "key" + }, + "Handler": "index.handler", + "Role": { + "Fn::GetAtt": [ + "MyFnRole", + "Arn" + ] + }, + "Runtime": "nodejs12.x", + "Tags": [ + { + "Key": "lambda:createdBy", + "Value": "SAM" + } + ] + }, + "Type": "AWS::Lambda::Function" + }, + "MyFnCognitoAuthorizerScopesOverwrittenPermission": { + "Properties": { + "Action": "lambda:InvokeFunction", + "FunctionName": { + "Ref": "MyFn" + }, + "Principal": "apigateway.amazonaws.com", + "SourceArn": { + "Fn::Sub": [ + "arn:${AWS::Partition}:execute-api:${AWS::Region}:${AWS::AccountId}:${__ApiId__}/${__Stage__}/GET/cognitoauthorizercopesoverwritten", + { + "__ApiId__": { + "Ref": "MyApiWithCognitoAuth" + }, + "__Stage__": "*" + } + ] + } + }, + "Type": "AWS::Lambda::Permission" + }, + "MyFnCognitoAuthorizerWithDefaultScopesPermission": { + "Properties": { + "Action": "lambda:InvokeFunction", + "FunctionName": { + "Ref": "MyFn" + }, + "Principal": "apigateway.amazonaws.com", + "SourceArn": { + "Fn::Sub": [ + "arn:${AWS::Partition}:execute-api:${AWS::Region}:${AWS::AccountId}:${__ApiId__}/${__Stage__}/GET/cognitoauthorizerwithdefaultscopes", + { + "__ApiId__": { + "Ref": "MyApiWithCognitoAuth" + }, + "__Stage__": "*" + } + ] + } + }, + "Type": "AWS::Lambda::Permission" + }, + "MyFnCognitoDefaultAuthDefaultScopesNonePermission": { + "Properties": { + "Action": "lambda:InvokeFunction", + "FunctionName": { + "Ref": "MyFn" + }, + "Principal": "apigateway.amazonaws.com", + "SourceArn": { + "Fn::Sub": [ + "arn:${AWS::Partition}:execute-api:${AWS::Region}:${AWS::AccountId}:${__ApiId__}/${__Stage__}/GET/cognitodefaultauthdefaultscopesnone", + { + "__ApiId__": { + "Ref": "MyApiWithCognitoAuth" + }, + "__Stage__": "*" + } + ] + } + }, + "Type": "AWS::Lambda::Permission" + }, + "MyFnCognitoDefaultScopesDefaultAuthorizerPermission": { + "Properties": { + "Action": "lambda:InvokeFunction", + "FunctionName": { + "Ref": "MyFn" + }, + "Principal": "apigateway.amazonaws.com", + "SourceArn": { + "Fn::Sub": [ + "arn:${AWS::Partition}:execute-api:${AWS::Region}:${AWS::AccountId}:${__ApiId__}/${__Stage__}/GET/cognitodefaultscopesdefaultauthorizer", + { + "__ApiId__": { + "Ref": "MyApiWithCognitoAuth" + }, + "__Stage__": "*" + } + ] + } + }, + "Type": "AWS::Lambda::Permission" + }, + "MyFnCognitoDefaultScopesNonePermission": { + "Properties": { + "Action": "lambda:InvokeFunction", + "FunctionName": { + "Ref": "MyFn" + }, + "Principal": "apigateway.amazonaws.com", + "SourceArn": { + "Fn::Sub": [ + "arn:${AWS::Partition}:execute-api:${AWS::Region}:${AWS::AccountId}:${__ApiId__}/${__Stage__}/GET/cognitodefaultscopesnone", + { + "__ApiId__": { + "Ref": "MyApiWithCognitoAuth" + }, + "__Stage__": "*" + } + ] + } + }, + "Type": "AWS::Lambda::Permission" + }, + "MyFnCognitoDefaultScopesWithOverwrittenPermission": { + "Properties": { + "Action": "lambda:InvokeFunction", + "FunctionName": { + "Ref": "MyFn" + }, + "Principal": "apigateway.amazonaws.com", + "SourceArn": { + "Fn::Sub": [ + "arn:${AWS::Partition}:execute-api:${AWS::Region}:${AWS::AccountId}:${__ApiId__}/${__Stage__}/GET/cognitodefaultscopesoverwritten", + { + "__ApiId__": { + "Ref": "MyApiWithCognitoAuth" + }, + "__Stage__": "*" + } + ] + } + }, + "Type": "AWS::Lambda::Permission" + }, + "MyFnRole": { + "Properties": { + "AssumeRolePolicyDocument": { + "Statement": [ + { + "Action": [ + "sts:AssumeRole" + ], + "Effect": "Allow", + "Principal": { + "Service": [ + "lambda.amazonaws.com" + ] + } + } + ], + "Version": "2012-10-17" + }, + "ManagedPolicyArns": [ + "arn:aws-cn:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" + ], + "Tags": [ + { + "Key": "lambda:createdBy", + "Value": "SAM" + } + ] + }, + "Type": "AWS::IAM::Role" + } + } +} diff --git a/tests/translator/output/aws-us-gov/http_api_with_auth_with_default_scopes.json b/tests/translator/output/aws-us-gov/http_api_with_auth_with_default_scopes.json new file mode 100644 index 000000000..b6b008f2f --- /dev/null +++ b/tests/translator/output/aws-us-gov/http_api_with_auth_with_default_scopes.json @@ -0,0 +1,368 @@ +{ + "Resources": { + "MyApiWithCognitoAuth": { + "Properties": { + "Body": { + "components": { + "securitySchemes": { + "MyCognitoAuthWithDefaultScopes": { + "type": "oauth2", + "x-amazon-apigateway-authorizer": { + "identitySource": "$request.header.Authorization", + "jwtConfiguration": { + "audience": [ + "audience2" + ], + "issuer": "https://www.example.com/v1/connect/oidc/other" + }, + "type": "jwt" + } + }, + "MyDefaultCognitoAuth": { + "type": "oauth2", + "x-amazon-apigateway-authorizer": { + "identitySource": "$request.header.Authorization", + "jwtConfiguration": { + "audience": [ + "audience1" + ], + "issuer": "https://www.example.com/v1/connect/oidc/default" + }, + "type": "jwt" + } + } + } + }, + "info": { + "title": { + "Ref": "AWS::StackName" + }, + "version": "1.0" + }, + "openapi": "3.0.1", + "paths": { + "/cognitoauthorizercopesoverwritten": { + "get": { + "responses": {}, + "security": [ + { + "MyCognitoAuthWithDefaultScopes": [ + "overwritten.read", + "overwritten.write" + ] + } + ], + "x-amazon-apigateway-integration": { + "httpMethod": "POST", + "payloadFormatVersion": "2.0", + "type": "aws_proxy", + "uri": { + "Fn::Sub": "arn:${AWS::Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${MyFn.Arn}/invocations" + } + } + } + }, + "/cognitoauthorizerwithdefaultscopes": { + "get": { + "responses": {}, + "security": [ + { + "MyCognitoAuthWithDefaultScopes": [ + "default.delete", + "default.update" + ] + } + ], + "x-amazon-apigateway-integration": { + "httpMethod": "POST", + "payloadFormatVersion": "2.0", + "type": "aws_proxy", + "uri": { + "Fn::Sub": "arn:${AWS::Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${MyFn.Arn}/invocations" + } + } + } + }, + "/cognitodefaultauthdefaultscopesnone": { + "get": { + "responses": {}, + "security": [ + { + "MyCognitoAuthWithDefaultScopes": [] + } + ], + "x-amazon-apigateway-integration": { + "httpMethod": "POST", + "payloadFormatVersion": "2.0", + "type": "aws_proxy", + "uri": { + "Fn::Sub": "arn:${AWS::Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${MyFn.Arn}/invocations" + } + } + } + }, + "/cognitodefaultscopesdefaultauthorizer": { + "get": { + "responses": {}, + "security": [ + { + "MyDefaultCognitoAuth": [ + "default.write", + "default.read" + ] + } + ], + "x-amazon-apigateway-integration": { + "httpMethod": "POST", + "payloadFormatVersion": "2.0", + "type": "aws_proxy", + "uri": { + "Fn::Sub": "arn:${AWS::Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${MyFn.Arn}/invocations" + } + } + } + }, + "/cognitodefaultscopesnone": { + "get": { + "responses": {}, + "security": [ + { + "MyDefaultCognitoAuth": [] + } + ], + "x-amazon-apigateway-integration": { + "httpMethod": "POST", + "payloadFormatVersion": "2.0", + "type": "aws_proxy", + "uri": { + "Fn::Sub": "arn:${AWS::Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${MyFn.Arn}/invocations" + } + } + } + }, + "/cognitodefaultscopesoverwritten": { + "get": { + "responses": {}, + "security": [ + { + "MyDefaultCognitoAuth": [ + "overwritten.read", + "overwritten.write" + ] + } + ], + "x-amazon-apigateway-integration": { + "httpMethod": "POST", + "payloadFormatVersion": "2.0", + "type": "aws_proxy", + "uri": { + "Fn::Sub": "arn:${AWS::Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${MyFn.Arn}/invocations" + } + } + } + } + }, + "tags": [ + { + "name": "httpapi:createdBy", + "x-amazon-apigateway-tag-value": "SAM" + } + ] + } + }, + "Type": "AWS::ApiGatewayV2::Api" + }, + "MyApiWithCognitoAuthApiGatewayDefaultStage": { + "Properties": { + "ApiId": { + "Ref": "MyApiWithCognitoAuth" + }, + "AutoDeploy": true, + "StageName": "$default", + "Tags": { + "httpapi:createdBy": "SAM" + } + }, + "Type": "AWS::ApiGatewayV2::Stage" + }, + "MyFn": { + "Properties": { + "Code": { + "S3Bucket": "bucket", + "S3Key": "key" + }, + "Handler": "index.handler", + "Role": { + "Fn::GetAtt": [ + "MyFnRole", + "Arn" + ] + }, + "Runtime": "nodejs12.x", + "Tags": [ + { + "Key": "lambda:createdBy", + "Value": "SAM" + } + ] + }, + "Type": "AWS::Lambda::Function" + }, + "MyFnCognitoAuthorizerScopesOverwrittenPermission": { + "Properties": { + "Action": "lambda:InvokeFunction", + "FunctionName": { + "Ref": "MyFn" + }, + "Principal": "apigateway.amazonaws.com", + "SourceArn": { + "Fn::Sub": [ + "arn:${AWS::Partition}:execute-api:${AWS::Region}:${AWS::AccountId}:${__ApiId__}/${__Stage__}/GET/cognitoauthorizercopesoverwritten", + { + "__ApiId__": { + "Ref": "MyApiWithCognitoAuth" + }, + "__Stage__": "*" + } + ] + } + }, + "Type": "AWS::Lambda::Permission" + }, + "MyFnCognitoAuthorizerWithDefaultScopesPermission": { + "Properties": { + "Action": "lambda:InvokeFunction", + "FunctionName": { + "Ref": "MyFn" + }, + "Principal": "apigateway.amazonaws.com", + "SourceArn": { + "Fn::Sub": [ + "arn:${AWS::Partition}:execute-api:${AWS::Region}:${AWS::AccountId}:${__ApiId__}/${__Stage__}/GET/cognitoauthorizerwithdefaultscopes", + { + "__ApiId__": { + "Ref": "MyApiWithCognitoAuth" + }, + "__Stage__": "*" + } + ] + } + }, + "Type": "AWS::Lambda::Permission" + }, + "MyFnCognitoDefaultAuthDefaultScopesNonePermission": { + "Properties": { + "Action": "lambda:InvokeFunction", + "FunctionName": { + "Ref": "MyFn" + }, + "Principal": "apigateway.amazonaws.com", + "SourceArn": { + "Fn::Sub": [ + "arn:${AWS::Partition}:execute-api:${AWS::Region}:${AWS::AccountId}:${__ApiId__}/${__Stage__}/GET/cognitodefaultauthdefaultscopesnone", + { + "__ApiId__": { + "Ref": "MyApiWithCognitoAuth" + }, + "__Stage__": "*" + } + ] + } + }, + "Type": "AWS::Lambda::Permission" + }, + "MyFnCognitoDefaultScopesDefaultAuthorizerPermission": { + "Properties": { + "Action": "lambda:InvokeFunction", + "FunctionName": { + "Ref": "MyFn" + }, + "Principal": "apigateway.amazonaws.com", + "SourceArn": { + "Fn::Sub": [ + "arn:${AWS::Partition}:execute-api:${AWS::Region}:${AWS::AccountId}:${__ApiId__}/${__Stage__}/GET/cognitodefaultscopesdefaultauthorizer", + { + "__ApiId__": { + "Ref": "MyApiWithCognitoAuth" + }, + "__Stage__": "*" + } + ] + } + }, + "Type": "AWS::Lambda::Permission" + }, + "MyFnCognitoDefaultScopesNonePermission": { + "Properties": { + "Action": "lambda:InvokeFunction", + "FunctionName": { + "Ref": "MyFn" + }, + "Principal": "apigateway.amazonaws.com", + "SourceArn": { + "Fn::Sub": [ + "arn:${AWS::Partition}:execute-api:${AWS::Region}:${AWS::AccountId}:${__ApiId__}/${__Stage__}/GET/cognitodefaultscopesnone", + { + "__ApiId__": { + "Ref": "MyApiWithCognitoAuth" + }, + "__Stage__": "*" + } + ] + } + }, + "Type": "AWS::Lambda::Permission" + }, + "MyFnCognitoDefaultScopesWithOverwrittenPermission": { + "Properties": { + "Action": "lambda:InvokeFunction", + "FunctionName": { + "Ref": "MyFn" + }, + "Principal": "apigateway.amazonaws.com", + "SourceArn": { + "Fn::Sub": [ + "arn:${AWS::Partition}:execute-api:${AWS::Region}:${AWS::AccountId}:${__ApiId__}/${__Stage__}/GET/cognitodefaultscopesoverwritten", + { + "__ApiId__": { + "Ref": "MyApiWithCognitoAuth" + }, + "__Stage__": "*" + } + ] + } + }, + "Type": "AWS::Lambda::Permission" + }, + "MyFnRole": { + "Properties": { + "AssumeRolePolicyDocument": { + "Statement": [ + { + "Action": [ + "sts:AssumeRole" + ], + "Effect": "Allow", + "Principal": { + "Service": [ + "lambda.amazonaws.com" + ] + } + } + ], + "Version": "2012-10-17" + }, + "ManagedPolicyArns": [ + "arn:aws-us-gov:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" + ], + "Tags": [ + { + "Key": "lambda:createdBy", + "Value": "SAM" + } + ] + }, + "Type": "AWS::IAM::Role" + } + } +} diff --git a/tests/translator/output/http_api_with_auth_with_default_scopes.json b/tests/translator/output/http_api_with_auth_with_default_scopes.json new file mode 100644 index 000000000..cfb85b60c --- /dev/null +++ b/tests/translator/output/http_api_with_auth_with_default_scopes.json @@ -0,0 +1,368 @@ +{ + "Resources": { + "MyApiWithCognitoAuth": { + "Properties": { + "Body": { + "components": { + "securitySchemes": { + "MyCognitoAuthWithDefaultScopes": { + "type": "oauth2", + "x-amazon-apigateway-authorizer": { + "identitySource": "$request.header.Authorization", + "jwtConfiguration": { + "audience": [ + "audience2" + ], + "issuer": "https://www.example.com/v1/connect/oidc/other" + }, + "type": "jwt" + } + }, + "MyDefaultCognitoAuth": { + "type": "oauth2", + "x-amazon-apigateway-authorizer": { + "identitySource": "$request.header.Authorization", + "jwtConfiguration": { + "audience": [ + "audience1" + ], + "issuer": "https://www.example.com/v1/connect/oidc/default" + }, + "type": "jwt" + } + } + } + }, + "info": { + "title": { + "Ref": "AWS::StackName" + }, + "version": "1.0" + }, + "openapi": "3.0.1", + "paths": { + "/cognitoauthorizercopesoverwritten": { + "get": { + "responses": {}, + "security": [ + { + "MyCognitoAuthWithDefaultScopes": [ + "overwritten.read", + "overwritten.write" + ] + } + ], + "x-amazon-apigateway-integration": { + "httpMethod": "POST", + "payloadFormatVersion": "2.0", + "type": "aws_proxy", + "uri": { + "Fn::Sub": "arn:${AWS::Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${MyFn.Arn}/invocations" + } + } + } + }, + "/cognitoauthorizerwithdefaultscopes": { + "get": { + "responses": {}, + "security": [ + { + "MyCognitoAuthWithDefaultScopes": [ + "default.delete", + "default.update" + ] + } + ], + "x-amazon-apigateway-integration": { + "httpMethod": "POST", + "payloadFormatVersion": "2.0", + "type": "aws_proxy", + "uri": { + "Fn::Sub": "arn:${AWS::Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${MyFn.Arn}/invocations" + } + } + } + }, + "/cognitodefaultauthdefaultscopesnone": { + "get": { + "responses": {}, + "security": [ + { + "MyCognitoAuthWithDefaultScopes": [] + } + ], + "x-amazon-apigateway-integration": { + "httpMethod": "POST", + "payloadFormatVersion": "2.0", + "type": "aws_proxy", + "uri": { + "Fn::Sub": "arn:${AWS::Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${MyFn.Arn}/invocations" + } + } + } + }, + "/cognitodefaultscopesdefaultauthorizer": { + "get": { + "responses": {}, + "security": [ + { + "MyDefaultCognitoAuth": [ + "default.write", + "default.read" + ] + } + ], + "x-amazon-apigateway-integration": { + "httpMethod": "POST", + "payloadFormatVersion": "2.0", + "type": "aws_proxy", + "uri": { + "Fn::Sub": "arn:${AWS::Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${MyFn.Arn}/invocations" + } + } + } + }, + "/cognitodefaultscopesnone": { + "get": { + "responses": {}, + "security": [ + { + "MyDefaultCognitoAuth": [] + } + ], + "x-amazon-apigateway-integration": { + "httpMethod": "POST", + "payloadFormatVersion": "2.0", + "type": "aws_proxy", + "uri": { + "Fn::Sub": "arn:${AWS::Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${MyFn.Arn}/invocations" + } + } + } + }, + "/cognitodefaultscopesoverwritten": { + "get": { + "responses": {}, + "security": [ + { + "MyDefaultCognitoAuth": [ + "overwritten.read", + "overwritten.write" + ] + } + ], + "x-amazon-apigateway-integration": { + "httpMethod": "POST", + "payloadFormatVersion": "2.0", + "type": "aws_proxy", + "uri": { + "Fn::Sub": "arn:${AWS::Partition}:apigateway:${AWS::Region}:lambda:path/2015-03-31/functions/${MyFn.Arn}/invocations" + } + } + } + } + }, + "tags": [ + { + "name": "httpapi:createdBy", + "x-amazon-apigateway-tag-value": "SAM" + } + ] + } + }, + "Type": "AWS::ApiGatewayV2::Api" + }, + "MyApiWithCognitoAuthApiGatewayDefaultStage": { + "Properties": { + "ApiId": { + "Ref": "MyApiWithCognitoAuth" + }, + "AutoDeploy": true, + "StageName": "$default", + "Tags": { + "httpapi:createdBy": "SAM" + } + }, + "Type": "AWS::ApiGatewayV2::Stage" + }, + "MyFn": { + "Properties": { + "Code": { + "S3Bucket": "bucket", + "S3Key": "key" + }, + "Handler": "index.handler", + "Role": { + "Fn::GetAtt": [ + "MyFnRole", + "Arn" + ] + }, + "Runtime": "nodejs12.x", + "Tags": [ + { + "Key": "lambda:createdBy", + "Value": "SAM" + } + ] + }, + "Type": "AWS::Lambda::Function" + }, + "MyFnCognitoAuthorizerScopesOverwrittenPermission": { + "Properties": { + "Action": "lambda:InvokeFunction", + "FunctionName": { + "Ref": "MyFn" + }, + "Principal": "apigateway.amazonaws.com", + "SourceArn": { + "Fn::Sub": [ + "arn:${AWS::Partition}:execute-api:${AWS::Region}:${AWS::AccountId}:${__ApiId__}/${__Stage__}/GET/cognitoauthorizercopesoverwritten", + { + "__ApiId__": { + "Ref": "MyApiWithCognitoAuth" + }, + "__Stage__": "*" + } + ] + } + }, + "Type": "AWS::Lambda::Permission" + }, + "MyFnCognitoAuthorizerWithDefaultScopesPermission": { + "Properties": { + "Action": "lambda:InvokeFunction", + "FunctionName": { + "Ref": "MyFn" + }, + "Principal": "apigateway.amazonaws.com", + "SourceArn": { + "Fn::Sub": [ + "arn:${AWS::Partition}:execute-api:${AWS::Region}:${AWS::AccountId}:${__ApiId__}/${__Stage__}/GET/cognitoauthorizerwithdefaultscopes", + { + "__ApiId__": { + "Ref": "MyApiWithCognitoAuth" + }, + "__Stage__": "*" + } + ] + } + }, + "Type": "AWS::Lambda::Permission" + }, + "MyFnCognitoDefaultAuthDefaultScopesNonePermission": { + "Properties": { + "Action": "lambda:InvokeFunction", + "FunctionName": { + "Ref": "MyFn" + }, + "Principal": "apigateway.amazonaws.com", + "SourceArn": { + "Fn::Sub": [ + "arn:${AWS::Partition}:execute-api:${AWS::Region}:${AWS::AccountId}:${__ApiId__}/${__Stage__}/GET/cognitodefaultauthdefaultscopesnone", + { + "__ApiId__": { + "Ref": "MyApiWithCognitoAuth" + }, + "__Stage__": "*" + } + ] + } + }, + "Type": "AWS::Lambda::Permission" + }, + "MyFnCognitoDefaultScopesDefaultAuthorizerPermission": { + "Properties": { + "Action": "lambda:InvokeFunction", + "FunctionName": { + "Ref": "MyFn" + }, + "Principal": "apigateway.amazonaws.com", + "SourceArn": { + "Fn::Sub": [ + "arn:${AWS::Partition}:execute-api:${AWS::Region}:${AWS::AccountId}:${__ApiId__}/${__Stage__}/GET/cognitodefaultscopesdefaultauthorizer", + { + "__ApiId__": { + "Ref": "MyApiWithCognitoAuth" + }, + "__Stage__": "*" + } + ] + } + }, + "Type": "AWS::Lambda::Permission" + }, + "MyFnCognitoDefaultScopesNonePermission": { + "Properties": { + "Action": "lambda:InvokeFunction", + "FunctionName": { + "Ref": "MyFn" + }, + "Principal": "apigateway.amazonaws.com", + "SourceArn": { + "Fn::Sub": [ + "arn:${AWS::Partition}:execute-api:${AWS::Region}:${AWS::AccountId}:${__ApiId__}/${__Stage__}/GET/cognitodefaultscopesnone", + { + "__ApiId__": { + "Ref": "MyApiWithCognitoAuth" + }, + "__Stage__": "*" + } + ] + } + }, + "Type": "AWS::Lambda::Permission" + }, + "MyFnCognitoDefaultScopesWithOverwrittenPermission": { + "Properties": { + "Action": "lambda:InvokeFunction", + "FunctionName": { + "Ref": "MyFn" + }, + "Principal": "apigateway.amazonaws.com", + "SourceArn": { + "Fn::Sub": [ + "arn:${AWS::Partition}:execute-api:${AWS::Region}:${AWS::AccountId}:${__ApiId__}/${__Stage__}/GET/cognitodefaultscopesoverwritten", + { + "__ApiId__": { + "Ref": "MyApiWithCognitoAuth" + }, + "__Stage__": "*" + } + ] + } + }, + "Type": "AWS::Lambda::Permission" + }, + "MyFnRole": { + "Properties": { + "AssumeRolePolicyDocument": { + "Statement": [ + { + "Action": [ + "sts:AssumeRole" + ], + "Effect": "Allow", + "Principal": { + "Service": [ + "lambda.amazonaws.com" + ] + } + } + ], + "Version": "2012-10-17" + }, + "ManagedPolicyArns": [ + "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole" + ], + "Tags": [ + { + "Key": "lambda:createdBy", + "Value": "SAM" + } + ] + }, + "Type": "AWS::IAM::Role" + } + } +}